LobotomyLabs/dumpsterChat
2
0
Fork 0
Code Issues Pull Requests Actions Packages Releases 10 Wiki Activity
269 Commits 1 Branch 21 Tags
02db6c719c1cb620964c1a8f4bf347950fd4fbdd
Commit Graph

11 Commits

Author SHA1 Message Date
hobokenchicken 1d6c9bdfe6 perf: rate limiter cleanup goroutine, DB pool constraints 
- ipLimiter evicts stale entries after 10 min of inactivity via 5 min sweep
- DB pool capped at 25 max open, 5 idle, 15 min lifetime
 2026-07-20 13:13:58 -04:00
hobokenchicken bda4c9d73d fix: handle 401 gracefully on web; add Bearer token auth for Tauri 
- fetchMe() no longer surfaces 401 as a user-facing error (it just
  means 'no session', not a failure)
- API client auto-clears auth state on 401 mid-session so the user
  gets redirected to login instead of seeing 'ERR: Request failed: 401'
- Session middleware now accepts Authorization: Bearer <token> header
  as fallback when no cookie is present (for Tauri/native clients)
- Login, register, and WebAuthn endpoints expose X-Session-Token header
  so non-browser clients can capture the token
 2026-07-16 14:46:17 -04:00
hobokenchicken 1ac176eb9f fix(webrtc): update CSP to allow background processor wasm and blob execution 2026-07-06 13:14:27 +00:00
hobokenchicken 0d822803f9 feat(webrtc): render remote audio tracks and allow camera access 2026-07-06 12:25:40 +00:00
hobokenchicken 8222cc9502 fix(webrtc): configure external TURN server and update CSP to allow inline scripts 2026-07-06 12:20:53 +00:00
hobokenchicken d3b7f39b9e fix(build): make build-web works; gofmt all Go files 2026-06-30 10:01:11 -04:00
hobokenchicken a8a09cf7b4 fix: CSRF and WS origin check trust request Host header (same-origin) 2026-06-29 14:38:18 -04:00
hobokenchicken 5c7e461dad fix: CSRF middleware now trusts origin hostname match instead of exact prefix 
The old CSRF middleware used exact string matching against a static list
of origins (https://host, http://localhost:port). This broke when the
frontend ran on a different port (Vite dev server) or accessed via LAN IP.

New behavior:
- Origin hostname matching: any Origin whose hostname matches cfg.Host
  is trusted, regardless of scheme or port
- Localhost variants always trusted: localhost, 127.0.0.1, ::1
- Additional origins can be passed explicitly (future env var support)
 2026-06-29 12:57:52 -04:00
hobokenchicken 130187c7be security: remediate all P0-P2 audit findings (12 tasks) 
P0 fixes:
- WebSocket origin checking (reject untrusted origins)
- WS session token moved from URL query param to first message frame
- WebAuthn login cookie now uses Secure flag via shared SetSessionCookie
- PostgreSQL sslmode configurable via POSTGRES_SSLMODE env (default: require)
- Fixed DatabaseDSN to use real password instead of masked placeholder

P1 fixes:
- Per-IP rate limiting middleware (auth: 5 req/s, invites: 2 req/s)
- Security headers on all responses (CSP, X-Frame-Options, nosniff, etc.)
- WS broadcasts scoped to server members (prevents cross-server data leak)
- Webhook tokens stored as SHA-256 hashes (not plaintext)

P2 fixes:
- CSRF protection via Origin header validation on state-changing requests
- MANAGE_CHANNELS permission enforced on channel update/delete
- Upload validation: 25MB limit, extension allowlist, server-side MIME check
- File serve: path traversal protection + Content-Disposition: attachment

Files: 23 changed, +499/-100. Builds clean (go build, go vet, npm build).
Zero CVEs (govulncheck, npm audit).
 2026-06-29 09:30:50 -04:00
hobokenchicken af1de3d140 Phase 6: Permissions, Push, WebAuthn scaffolding 
Backend:
- internal/permissions/permissions.go: permission bitflags (VIEW_CHANNEL through SHARE_SCREEN)
- internal/permissions/checker.go: permission checker with role aggregation
- internal/middleware/permission.go: RequirePermission middleware
- internal/push/handlers.go: push subscription CRUD, VAPID key endpoint, SendPush
- internal/auth/webauthn.go: WebAuthn passkey scaffolding (begin/finish endpoints)
- internal/db/db.go: is_default on roles, push_subscriptions table, webauthn_credentials table
- go.mod: added webpush-go, go-webauthn dependencies

Frontend:
- stores/role.ts: Zustand store for role management
- RoleManager.tsx: role CRUD with permission checkboxes
- MemberRoleAssign.tsx: assign roles to members
- App.tsx: /servers/:serverId/roles route
 2026-06-28 17:53:44 -04:00
hobokenchicken e499ce884d Initial scaffold: Go backend, React frontend, Docker Compose 
- Go backend: config, db (PostgreSQL migrations), auth (argon2id + sessions),
  middleware (cookie sessions, RequireAuth), chi router, cmd/server
- React frontend: Vite + React 18 + TS + Tailwind + Gruvbox palette + terminal CSS
- Docker: compose.yml (Postgres, Valkey, minio, LiveKit, coturn, Caddy),
  livekit.yaml, Caddyfile, Dockerfile (multi-stage Go+Node+Alpine)
- .env.example, .gitignore, README.md
 2026-06-26 14:41:10 -04:00